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Claims 

1. An apparatus for detecting performance, availability and content 
deviations in enterprise software applications, comprising: 

5 

a plurality of data collectors for intercepting messages exchanged 
between independent ser\/ices in an enterprise software application; and 

an analyzer for detemiining a baseline for said enterprise software 
10 application and for detecting deviations from said baseline. 

2. The apparatus of Claim 1 , further comprising: 

a graphical user interface (GUI) for displaying deviations from said 
baseline in said enterprise software application. 

15 

3. The apparatus of Claim 2, said analyzer comprising: 

a collector manager for controlling said plurality of data collectors; 

20 a correlation engine (CE) for correlating streams of said messages to a 

transaction; 

a statistical processor for collecting real-time statistics on entities within 
said enterprise software application; 

25 

a baseliner for determining at least said baseline, wherein said baseline 
represents a normal behavior of said entities within said enterprise 
software application; 

30 a fault prediction and detection engine (FPDE) for performing an early 

detection of deviations from said baseline in said enterprise software 
application; and 
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a presentation and alerts engine for generating reports and alerts for 
display on said GUI. 



4. The apparatus of Claim 3, said analyzer further comprising: 

5 

an analytic processor for analyzing overall activity of said transactions of 
said enterprise software application. 

5. The apparatus of Claim 3, said analyzer further comprising: 

10 a root cause analyzer (RCA) for automatically providing a detailed analysis of 
a 

root cause of each fault detected by said FPDE. 

6. The apparatus of Claim 3, wherein said data collectors capture 
15 messages transmitted using communication protocols comprising any of: 

a simple object access protocol (SOAP); 
a hypertext transfer protocol (HTTP); 
an extensible markup language (XML); 
a Microsoft message queuing (MSMQ);and 
20 a Java message service (JMS). 

7. The apparatus of Claim 3, said FPDE performing early detection of any 
of: 

operation faults (bugs) in said enterprise software application; and 
25 decrement in performance of said user enterprise software application. 

8. The apparatus of Claim 7, wherein operation faults are detected during 
production of said enterprise software application. 

30 9. The apparatus of Claim 1 , said data collectors receiving said messages 
through an application programming interface (API). 

1 0. The apparatus of Claim 1 , wherein said baseline is determined based on 
any: 
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content of said messages; 
context of said messages; and 
real-time statistics. 

5 11. The apparatus of Claim 10, wherein said real-time statistics comprise 
any of: 

throughput measurements; and 

average response time measurements of business transactions. 

10 12. A method for detecting performance, availability and content deviations 
in enterprise software applications, comprising the steps of: 

Intercepting messages exchanged between independent services in an 
enterprise software application; 

15 

correlating said messages Into a transaction; 
detenninlng a baseline for said enterprise software application; and 
20 detecting deviations from said baseline. 

13. The method of Claim 12, said step of detecting deviations further 
comprising the step of: 

performing an early detection of any of operation faults (bugs) In said 
25 enterprise software application and decrement In performance of said 

enterprise software application. 

14. The method of Claim 13, further comprising the step of: 

detecting said operation faults during production of said enterprise 
30 software application. 

15. The method of Claim 12, further comprising the step of: 

displaying information about any of said operation faults and 
performance evaluation to a user. 
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16. The method of Claim 15, wherein said information is displayed to said 
user through a series of graphical user interface (GUI) views. 

17. The method of Claim 12, said step of intercepting messages further 
comprising the step of: 

receiving said messages through an application programming interface 
(API). 

18. The method of Claim 12, said step of correlating said messages further 
comprising the steps of: 

assembling messages related to an Instance of a transaction; 

determining an execution flow graph of a transaction instance; 

mapping said execution flow graph with similar transaction instances; 
and 

grouping said transaction instances to create an execution path that 
identifies said transaction. 

19. The method of Claim 12, wherein said baseline is determined based on 
any of content of said messages, context of said messages, and real- 
time statistics. 

20. The method of Claim 19, wherein said real-time statistics comprise any 
of: throughput measurements, average response time measurements. 

21 . The method of Claim 1 2, said method further comprising the step of: 

performing a root cause analysis to detect a root cause for detected 
baseline deviations. 
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22. A computer software product readable by a machine, tangibly embodying 
a program of instructions executable by said machine to implement a 
process for detecting performance, availability, and content deviations in 
enterprise software applications, the method comprising the steps of: 

5 

Intercepting messages exchanged between independent services of an 
enterprise software application; 

correlating said messages into at least a business transaction; 

determining a baseline for said enterprise software application; and 

detecting deviations from said baseline. 

15 23. The computer software product of Claim 22, said step of detecting said 
deviations further comprises the step of: 

performing an early detection of any of operation faults (bugs) in said 
enterprise software application, decrement in performance of said 
20 enterprise software application. 

24. The computer software product of Claim 22, further comprising the step 
of: 

displaying information about any of operation faults and perfomiance 
25 evaluation to a user. 

25. The computer software product of Claim 24, wherein said information is 
displayed to said user through a series of graphical user interface (GUI) 
views. 

30 

26. The computer software product of Claim 22, said step of correlating said 
messages further comprising the steps of: 



assembling messages related to an instance of a transaction; 
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determining an execution flow graph of a transaction instance; 

mapping said execution flow graph with similar transaction instances; 
5 and 

grouping said transaction instances to create an execution path that 
identifies said transaction. 

10 27. The computer software product of Claim 22, wherein said baseline is 
detennined based on any of content of said messages, context of said 
messages, and real-time statistics. 

28. The computer software product of Claim 27, wherein said real-time 
15 statistics comprise: throughput measurements, and average response 

time measurements. 

29. The computer software product of Claim 22, said method further 
comprising the step of: 

20 

performing a root cause analysis to detect a root cause for detected 
baseline deviations. 
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